IP Reputation

IP reputation is a risk score that indicates how trustworthy an IP address is. IP reputation services collect data from spam traps, honeypots, threat intelligence feeds, and abuse reports to score IPs on a scale (typically 0-100, where lower is riskier).

Reputation indicators

• Spam sending history.
• Malware distribution.
• Botnet participation.
• Brute force attacks.
• Scanning and probing.
• Age of IP assignment.
• ASN (network) reputation.

Reputation sources

• Blacklists (DNSBL, RBL).
• Threat intelligence feeds.
• Honeypot networks.
• Spam trap data.
• Crowdsourced reports.

Use cases

• Email filtering (block spam senders).
• Web application firewalls (block attackers).
• Access control (geofencing, threat blocking).
• Fraud detection (payment, account creation).

Limitations

• Shared IPs (cloud/VPN) can have mixed reputation.
• False positives from legitimate scanning.
• IP address rotation by attackers.
• Legitimate users behind proxies/VPNs.